Stopping Break-ins: Firewalls

It may seem like an odd form of entertainment, but there’s a whole sub- culture out there of people who spend their time trying to break into other people’s computers. Some of these people are just in it for the game, but others are cracking into computers as a way to steal personal and corporate information. As anyone who has ever had to deal with identity theft can tell you, taking back control of your life after someone has stolen your credit card numbers, computer passwords, bank account numbers, and other per- sonal data is the bureaucratic equivalent of root canal surgery. Anytime your computer is connected to the Internet or a local network, there’s a possibility that someone will try to break into your files. It’s not that the data on your computer is anymore attractive than the data on any of the millions of other computers online, but the most common way for people to find unprotected machines is to systematically scan through every possible numeric Internet address. If your computer is connected to the Internet all the time, attempts to gain access to your system can occur dozens of times every day.

Even if you use a dial-up modem, your connection is still at risk. You can test your computer’s potential exposure to intruders by running a security audit through HackerWhacker (http://hackerwhacker.com), AuditMyPC.com (www.auditmypc.com/freescan), ShieldsUP!! (www.grc .com/x/ne.dll), and other websites. These programs scan all possible entry points on your system (known as ports) and identify the ones that are not protected. For additional test sites, search the Internet for “security firewall scan.” Use a firewall to protect your computer from unwanted access. A firewall is either an external device located between the network port of your com- puter and the router that connects it to the local network or the Internet, or a software program (like ZoneAlarm) that runs on your computer and mon- itors network activity. (If your computer is connected to the Internet through a local network, it’s common to place the firewall between the network hub and the Internet so that a single firewall can protect the entire network.) Whether it’s internal or external, a firewall allows acceptable data to move into and out of the computer or local network, but it restricts attempts to move data to and from unauthorized sources or destinations.

Firewall Software

If your computer is connected directly to the Internet through a broadband connection or a telephone line, a firewall program such as ZoneAlarm (free for personal use), Norton Personal Firewall, or a similar program from McAfee or other suppliers is generally your best choice. The Norton and McAfee products are often bundled with other programs in those Internet security suites we discussed earlier. The Home PC Firewall Guide (www .firewallguide.com) keeps up with the latest versions of many firewall pro- grams and offers links to sources for free and trial downloads. Most firewalls compare each connection request to the entries on a list that identifies acceptable or restricted origins and destinations. When an incoming request for a connection to your computer tries to read a file or run a program that should not be available to outsiders, the firewall blocks the connection. But when the request is headed for a safe destination such as your web browser, the firewall lets it pass. The firewall treats outbound communication attempts the same way: If a request to connect to the Internet originates in a program that should not be sending messages, the firewall will block that message.

NOTE Most firewall programs offer a default configuration that provides the best compromise between protection and convenience. You can generally override the default settings to allow access to a specific program or data port.

Windows XP SP2 includes Internet Connection Firewall software that can perform many of the same functions as a third-party firewall program. Because you already have it on your system, you might as well turn it on and run a security audit (see the previous section for pointers to online firewall audit services) before spending additional time and money to obtain and install a firewall from another source. If you’re connected to the Internet through a local network, turn off the Internet Connection Firewall and use the firewall in your network hub. To turn on the Windows Internet Connection Firewall, follow these steps:

1. From Control Panel, select Network Connections and choose the icon that identifies your connection to the Internet. The dialog box in Fig- ure 12-2 should appear. 2. Click the Properties button. A Properties window will appear. 3. Select the Advanced tab, and click the Settings button to display the dia- log box. 4. Check the On option to enable the firewall.

Firewall Hardware

A firewall built into a network router or switch is the better choice for users who have more than one computer connected to the Internet through a local area network (LAN). By placing the firewall where the local network connects to the Internet, a single firewall can protect all the computers in the network and still allow file sharing among the computers behind the firewall. You may already have a firewall in place if you’re using a cable or DSL router to share your Internet connection among the computers in your home or small business. If you’re on a larger corporate or campus network, the firewall might be a separate device. The need for firewalls and spyware protection is just another reflection of the evil floating around in today’s world. Neither has anything to do with the things you want your computer to do for you, but like locking the door when you leave the house, you have to take some kind of preventive steps to make sure you don’t end up spending a lot more time and energy later to recover from the damage that an unprotected computer can sustain. It’s unfortunate, but protecting yourself from intruders and snoops is just one of the costs of running a computer.